[PATCH net v5 0/6] net: phy: fix cleanup after probe failure

From: Xuanqiang Luo <[email protected]>

phy_probe() initializes the PHY driver, ports, SFP upstream, and LEDs in
stages. Its error paths do not always release only the resources acquired
at each stage. It can also mark the PHY ready before all setup succeeds.

Port setup also leaves SFP cleanup split between phy_sfp_probe(),
phy_setup_ports(), and phy_probe(), and default port setup ignores errors
from attaching the port to the PHY driver.

This series makes each initialization layer own its cleanup and propagates
setup failures to the caller.

Patch 1 splits the phy_probe() cleanup by initialization stage.

Patch 2 makes SFP and port setup unwind their resources in the required
order.

Patch 3 sets PHY_READY only after LED setup succeeds.

Patch 4 calls the PHY driver remove callback after later probe failures.

Patch 5 propagates errors from default port setup.

Patch 6 prevents a double-free after partial LED trigger registration.

---
Changes:
v5:
  Patch 1:
  - Describe the NULL-dereference path after a probe/remove cycle and add
    the corresponding Fixes tag. (Sashiko.)

  Patch 5:
  - Correct the Reviewed-by tag to Maxime Chevallier.

  Patch 6:
  - Mention the phy_remove() teardown path that can also trigger the
    double-free. (Sashiko.)

v4: https://lore.kernel.org/all/[email protected]/
  Patch 1:
  - Explain that LED triggers are initialized after the SFP upstream and
    ports, so they must be unwound first. (Andrew Lunn.)

  Patch 2-5:
  - Add Reviewed-by: Andrew Lunn <[email protected]>.

  Patch 6 (new):
  - Prevent a double-free after partial LED trigger registration and make
    the cleanup ownership explicit. (Sashiko.)

v3: https://lore.kernel.org/all/[email protected]/
  Patch 1:
  - Rename cleanup labels to include verbs describing their actions.
    (Jakub Kicinski.)

  Patch 3:
  - Do not clear phydev->drv before device-core teardown completes; this
    can expose NULL dereferences in concurrent attach paths and devres
    callbacks. Set PHY_READY only after LED setup succeeds and update the
    Fixes tag. (Sashiko, Jakub Kicinski.)

v2: https://lore.kernel.org/all/[email protected]/
  Patch 1:
  - Limit this patch to splitting phy_probe() error paths, moving the SFP
    teardown fixes to Patch 2.

  Patch 2 (new):
  - Make SFP and port setup unwind their resources in the required order.
  - Add phy_sfp_release() for complete SFP teardown instead of open-coding
    sfp_bus_del_upstream(). (Andrew Lunn, Maxime Chevallier.)

  Patch 3 (new):
  - Restore PHY_DOWN and clear phydev->drv after probe failure.

  Patch 4:
  - Move the former Patch 2 to Patch 4; no functional changes.

  Patch 5 (new):
  - Propagate errors from default port setup.

v1: https://lore.kernel.org/all/[email protected]/

Xuanqiang Luo (6):
  net: phy: split phy_probe() error paths
  net: phy: unregister SFP upstream before port cleanup
  net: phy: set PHY_READY after LED setup
  net: phy: call driver remove when core initialization fails
  net: phy: propagate errors from default port setup
  net: phy: avoid double-free after LED trigger registration failure

 drivers/net/phy/phy_device.c       | 80 ++++++++++++++++++++++--------
 drivers/net/phy/phy_led_triggers.c | 11 ++--
 2 files changed, 65 insertions(+), 26 deletions(-)


base-commit: 746fc0787f616da418ffc04a110296fe95d53491
-- 
2.43.0